Skip to content

fix(google-workspace): normalize authorized user token writes#10986

Merged
teknium1 merged 1 commit into
mainfrom
hermes/hermes-5e6c8607
Apr 16, 2026
Merged

fix(google-workspace): normalize authorized user token writes#10986
teknium1 merged 1 commit into
mainfrom
hermes/hermes-5e6c8607

Conversation

@teknium1

Copy link
Copy Markdown
Contributor

Summary

Normalizes freshly written Google Workspace tokens to include "type": "authorized_user" so the gws CLI backend accepts them immediately after OAuth setup.

Fixes #10913. Cherry-picked from #10919 (credit: @LeonSGP43).

What changed

  • Added _normalize_authorized_user_payload() helper to setup.py, google_api.py, and gws_bridge.py
  • Applied normalization at all 4 token write points:
    • exchange_auth_code() — initial token write after OAuth
    • check_auth() — token refresh in setup script
    • get_credentials() — token refresh in API script
    • refresh_token() — gws bridge refresh
  • Added tests verifying "type" field is persisted

Test plan

pytest -o addopts= tests/skills/test_google_oauth_setup.py tests/skills/test_google_workspace_api.py
# 14 passed

@teknium1 teknium1 merged commit daef051 into main Apr 16, 2026
3 of 5 checks passed
@teknium1 teknium1 deleted the hermes/hermes-5e6c8607 branch April 16, 2026 11:22
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

skills/productivity/google-workspace/scripts/setup.py
tests/skills/test_google_oauth_setup.py

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: google-workspace writes a fresh token without "type", and the gws path rejects it until a later runtime rewrite

2 participants